found it on my sisters computer as the home page changed it back to default rebooted and was there again.
found a suspicious program running rdminer.exe, deleted it and problem solved.
just posting this for anyone else that comes across this issue.

often when you get a trojan like that, it can cause bigger problems
they sometimes leave other files in windows or system32 folder that can unzip themselves or overwrite registry entries and run at startup or whenever

glad you caught it, run spybot and a virus scanner to make sure you cleaned up all of it